This vulnerability (CVE-2026-0390) affects Windows 10 Version 1607 (build 10.0.14393.0) and is categorized under CWE-807, which relates to reliance on untrusted inputs in security decisions. Specifically, the Windows Boot Loader improperly trusts input data, enabling an authorized local attacker to bypass certain security features. The CVSS 3.1 vector indicates the attack requires local access with low complexity, high privileges, no user interaction, and impacts confidentiality, integrity, and availability. Microsoft has published an official fix to remediate this vulnerability.

An authorized local attacker can exploit this vulnerability to bypass security features in the Windows Boot Loader, potentially leading to full compromise of system confidentiality, integrity, and availability. The medium severity reflects the requirement for local access and high privileges, limiting remote exploitation but still posing a significant risk on affected systems.

Microsoft has released an official fix for this vulnerability. It is strongly recommended to apply the provided security update from the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-0390 to remediate this issue. No additional mitigations are specified by the vendor.